CVE-2026-90375
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix non-AQL packet accounting for MLO stations __mt76_tx_queue_skb() overrides the wcid passed by the driver with sta->drv_priv, so the wcid might incorrectly be changed after TX, causing wcid->non_aql_packets to be counted on the wrong wcid. For example, on the AP side, if a station's setup link is the 5G link and the station uses 2G to transmit a frame, the value of non_aql_packets is increased on the 5G wcid but decreased on the 2G wcid. Once the inflated counter exceeds MT_MAX_NON_AQL_PKT, the TX scheduler permanently refuses to service the station. Drop the reassignment and account on the wcid used for transmission. This also records the actual wcid in the queue entry.
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 6% of CVEs (scores of 2026-10-25)
- Published
- Modified
- Record from
- the NVD, synced
References
- https://git.kernel.org/stable/c/186c957ac3325aefb982567ffdd3654b283688a7
- https://git.kernel.org/stable/c/2c321f86846ead00552bc65f73f5b5f1f81d4023
- https://git.kernel.org/stable/c/8ae659743ba936b22ecb4620815887728e2820d6
- https://git.kernel.org/stable/c/f85f6933cc170155f1c7c2dffdd014965787c71b
- https://git.kernel.org/stable/c/fc7fae55255ccbde009232e84b102d2782a69ecf